Hacking Articles Tips Tricks Videos Tutorials

A Story About How i Found CVE-2020–27838 in TVH responsible disclosure

A Story About CVE-2020–27838 in TVH responsible disclosure A few months ago, during a security assessment of a client’s system, I stumbled upon a critical flaw in the TVH authentication server that could expose sensitive information. This vulnerability, identified as CVE-2020–27838, allows unauthorized access to client registration details in Keycloak, potentially compromising the confidentiality of sensitive data. Here’s how I discovered and explored this vulnerability.The Discovery While testing the TVH authentication server, I identified a vulnerability in the Keycloak client registration endpoint that allowed information exposure without proper authentication. Specifically, I found that the endpoint at https://xxxxxxx.tvh.com/auth/realms/master/clients-registrations/default/security-admin-console was leaking sensitive details.Understanding the VulnerabilityBug Name: Information ExposureBug Priority: MediumVulnerable URL: https://xxxx.tvh.com/auth/realms/master/clients-registrations/default/security-admin-console CVE Description: This vulnerability was found in Keycloak versions prior to 13.0.0. The issue lies in the client registration endpoint, which allows fetching information about PUBLIC clients, including the client secret, without requiring authentication. This becomes particularly dangerous if a PUBLIC client is later switched to CONFIDENTIAL status, as the previously exposed secrets could still be accessed without proper authorization. The highest risk from this flaw is the potential compromise of data confidentiality.Impact The vulnerability allows an attacker to gain sensitive information from the Keycloak server, which could be exploited to access or manipulate client data. This could lead to unauthorized access to confidential information, potentially compromising the integrity of the affected system.Automating the Hunt To streamline the process of identifying this vulnerability, I developed a Python tool that automates the testing of the vulnerable endpoint. You can easily install and use this tool as follows: ToolPOC: CVE-2020–27838 on githubpip install CVE-2020-27838 CVE-2020-27838 --chatid <YourTelegramChatID>To Check a Single URL:CVE-2020-27838 -u http://mytargetprogram.comTo Check a List of URLs:CVE-2020-27838 -i urls.txtProof of Concept (POC) To demonstrate the vulnerability, the tool automates the process of testing the endpoint for information exposure. Here’s a sample POC image:POC ImageRemediation To mitigate this vulnerability, it is essential to apply the latest security patches or updates provided by the Keycloak vendor. Updating to a version later than 13.0.0 will resolve this issue by requiring proper authentication before accessing sensitive client information. POC by: @karthithehacker Mail: contact@karthithehacker.com Website: https://www.karthithehacker.com/ If you’re interested in our VAPT service, contact us at ceo@cappriciosec.com or contact@cappriciosec.com. For enrolling my cybersecurity and Bugbounty course, WhatsApp +91 82709 13635.Connect with me: Twitter: https://twitter.com/karthithehacker Instagram: https://www.instagram.com/karthithehacker/ LinkedIn: https://www.linkedin.com/in/karthikeyan--v/ Website: https://www.karthithehacker.com/ Github : https://github.com/karthi-the-hacker/ npmjs: https://www.npmjs.com/~karthithehacker Youtube: https://www.youtube.com/@karthi_the_hackerThank you Karthikeyan.V A Story About How i Found CVE-2020–27838 in TVH responsible disclosure was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...

19 views09:40

What is WAF? & Secret Techniques to Bypass It

WAF (Web Application Firewall): A tool designed to filter and monitor HTTP/HTTPS traffic, preventing attacks on web applications at the…Continue reading on InfoSec Write-ups »
Read more...

Medium

What is WAF? & Secret Techniques to Bypass It

WAF (Web Application Firewall): A tool designed to filter and monitor HTTP/HTTPS traffic, preventing attacks on web applications at the…

17 views09:40

Hacking Articles Tips Tricks Videos Tutorials

Unauthorized Deletion of Forms by Low-Level Unlicensed Users: A 500$ Access Control Bug

Continue reading on InfoSec Write-ups »
Read more...

Medium

Unauthorized Deletion of Forms by Low-Level Unlicensed Users: A 500$ Access Control Bug

Hi Everyone, Today, I’m excited to share a vulnerability I discovered in ExamSheet Enterprise. This security flaw allows low-level, unlicensed users to delete forms, despite lacking the necessary…

17 views09:58

Hacking Articles Tips Tricks Videos Tutorials

My recon methodology for hunting CVE-2021–42063 led to discovering an RXSS vulnerability in the…

My recon methodology for hunting CVE-2021–42063 led to discovering an RXSS vulnerability in the Tata Play program Part -1 . During one of my bug bounty hunting sessions, I came across an interesting vulnerability: CVE-2021–42063. Let me walk you through how I found this bug and explain the steps I followed. To begin, I always rely on a recon tool that I developed called Ghost Recon. This tool helps me with subdomain enumeration and brute-forcing. Of course, you can do the same process without Ghost Recon. If you’re interested in trying it, you can check it out on GitHub: Ghost Recon. For this recon phase, I started by running two tools: subfinder and subsleuth. These help in finding and enumerating subdomains efficiently. The commands I used are:subfinder -d tataplay.com -all -o subfinder.txt subsleuth -d tataplay.com -w wordlist.txt -o output.txt Next, I combined the results, removed duplicates, and performed the process multiple times to ensure I didn’t miss any subdomains. The results were sorted and refined into a file of third-level domains. Here’s how I cleaned up the results:cat * | sort -u | tee -a dup.txt cat dup.txt | rev | cut -d "." -f 1,2,3 | sort -u | rev >> 3rdlevel.txt subfinder -dL 3rdlevel.txt -o final.txt subsleuth -l 3rdlevel.txt -w wordlist.txt -o final1.txt cat * | sort -u | tee -a done.txt With the recon process done, it was time to move on to port scanning. I used my custom script and tools like naabu for this. Once the ports were scanned, I fed the results into httpx to identify live hosts:httpx -l ports-withsubs.txt -o live.txt Now, here’s where the magic happens. I installed the CVE-2021–42063 tool from pip, which automates the process of detecting the vulnerability:pip install CVE-2021-42063 pip install yaml #if needed CVE-2021-42063 --chatid <YourTelegramChatID> CVE-2021-42063 -i urls.txt -o out.txt This tool does all the work for you. It scans the provided URLs for the vulnerability, and if it finds any, you get a notification on Telegram instantly. In this case, it flagged the vulnerable URL on partner.tataplay.com. This vulnerability, CVE-2021–42063, was a reflected XSS (R-XSS) in the SAP Knowledge Warehouse component. Exploiting this allowed an attacker to execute scripts in a user’s browser, potentially stealing sensitive information or hijacking the user’s session.Tool POC: In part 2, I will write about the CVE, the core details of the bug, along with POC images. POC by: @karthithehacker Mail: contact@karthithehacker.com Website: https://www.karthithehacker.com/ If you’re interested in our VAPT service, contact us at ceo@cappriciosec.com or contact@cappriciosec.com.Connect with me: Twitter: https://twitter.com/karthithehacker Instagram: https://www.instagram.com/karthithehacker/ LinkedIn: https://www.linkedin.com/in/karthikeyan--v/ Website: https://www.karthithehacker.com/ Github : https://github.com/karthi-the-hacker/ npmjs: https://www.npmjs.com/~karthithehacker Youtube: https://www.youtube.com/@karthi_the_hackerThank you Karthikeyan.V My recon methodology for hunting CVE-2021–42063 led to discovering an RXSS vulnerability in the… was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...

Karthithehacker

👋 Hey, I'm Karthikeyan, a passionate cybersecurity researcher and ethical hacker.🚀

26 views09:58

Hacking Articles Tips Tricks Videos Tutorials

Would you mind to tell me what your bank balance is? No? Okay, I’ll hack it.

IDOR x Bank = Exposed bank balance. Alright people, let’s do this one last time. I’m Manav Bankatwala, and I’m a security researcher. I’m not sure what kind of radioactive spider bit me, but it gave me the power to see security vulnerabilities everywhere.Summary: The vulnerability I am describing in this writeup is quite old, which I found way back when I was active in bug bounty. Imagine you are asking for money back from your friend, and he/she says, I am broke. But you found out that he/she is lying because you can hack into and see the actual bank balance of your friend. Ahaa, you got him. It’s a very simple vulnerability, but due to the impact I feel to write about it. So, the vulnerability here we are talking about is an IDOR (Insecure Direct Object Reference). I found this vulnerability in one of India’s fastest-growing digital banks. With this IDOR, I was able to see the actual bank balance of any user using their bank account number. Yes, you heard that right. Maybe I saw your bank balance? Haha😉Background: So, every month I download my bank statements to see the expenses and manage them. One afternoon, after hunting on a bug bounty program, I thought to log into my bank account and download my statement. But after completing the whole statement download thing, I realized that I forgot to turn off the interception proxy. Due to this, all the requests were captured. I thought to just let it go, but it made me curious and think if I could find any security vulnerability, and I did find it.Methodology: I didn’t want to do much aggressive testing and things like that, so just to keep it simple, I decided to look for IDORs in all the API requests that have account numbers as a parameter.Opened the burp suite search tab.I entered my own account number, which gave me a list of endpoints where my account number was provided as a parameter.Out of all, I found an API endpoint at /api/account/v1/m-balance.It was a post request, and the JSON body was having my account number.Request 5. I sent this request to repeater and changed the last two digits of my account number. Upon sending, instead of an error, it gave me the balance of another user bank account number.Response To further test this, I simply sent the request to the intruder and iterated a list of bank account numbers. And ya, I got the bank balance of all the users with just one click. Without wasting time, I made a report and submitted it to the authorities. But guess what? Banks don’t think that account balance is a sensitive thing to get exposed to. The replied, “Through an API, an authenticated user can only enumerate the balance of an account number; no other customer details are exposed through an API. After analyzing the issue, we have categorized it as of ‘Low’ severity.”Conclusion: Do you think that bank balance exposure is really not a concern? It’s like posting your bank balance on a notice board. Are you okay if your bank balance is listed on that notice board where anyone can see it? Let me know what are your views on this and in what more this could have been exploited. Until that, adiósFollow me to get latest updates: https://www.linkedin.com/in/manavbankatwala/ https://www.instagram.com/manav.bug/ https://twitter.com/manavbankatwala Would you mind to tell me what your bank balance is? No? Okay, I’ll hack it. was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.
Read more...

9 views09:58

Hacking Articles Tips Tricks Videos Tutorials

Mastering Reconnaissance with Nmap: Unveiling Your Target’s Secrets

Nmap (Network Mapper) is one of the most powerful and widely-used open-source tools for network discovery and security auditing. It’s a…Continue reading on InfoSec Write-ups »
Read more...

Medium

Mastering Reconnaissance with Nmap: Unveiling Your Target’s Secrets

Nmap (Network Mapper) is one of the most powerful and widely-used open-source tools for network discovery and security auditing. It’s a…

7 views09:58

Hacking Articles Tips Tricks Videos Tutorials

Optimal Ethical Hacker Setup for Penetration Testing

1. HardwareContinue reading on InfoSec Write-ups »
Read more...

Medium

Optimal Ethical Hacker Setup for Penetration Testing

1. Hardware

11 views09:58

Hacking Articles Tips Tricks Videos Tutorials

Would you mind to tell me what your bank balance is? No? Okay, I’ll hack it.

IDOR x Bank = Exposed bank balance.Continue reading on InfoSec Write-ups »
Read more...

Medium

Would you mind to tell me what your bank balance is? No? Okay, I’ll hack it.

IDOR x Bank = Exposed bank balance.

13 views10:18

Hacking Articles Tips Tricks Videos Tutorials

need an advise
https://www.reddit.com/r/Pentesting/comments/1fdcsdr/need_an_advise/

hi, everyone
i'm new to pentesting field but i have no experience. i have common knowledge about pentesting but i don't know where to start. can anyone tell me , as a entry-level pentester, what are my missions ?  submitted by /u/South_Actuator_8639 (https://www.reddit.com/user/South_Actuator_8639)
[link] (https://www.reddit.com/r/Pentesting/comments/1fdcsdr/need_an_advise/) [comments] (https://www.reddit.com/r/Pentesting/comments/1fdcsdr/need_an_advise/)

11 views10:46

Hacking Articles Tips Tricks Videos Tutorials

Free Bug Bounty Course For Beginners ️

Size : 5GbContinue reading on Medium »
Read more...

8 views12:17

Hacking Articles Tips Tricks Videos Tutorials

Basic Challenge Level 9

The password is again hidden in an unknown file. However, the script that was previously used to find it has some limitations…Continue reading on Medium »
Read more...

Medium

Basic Challenge Level 9

The password is again hidden in an unknown file. However, the script that was previously used to find it has some limitations…

8 views12:17

Hacking Articles Tips Tricks Videos Tutorials

Basic Challenge Level 10

This time Sam used a more temporary and ‘hidden’ approach to authenticating users, but he didn’t think about whether or not those users…Continue reading on Medium »
Read more...

Medium

Basic Challenge Level 10

This time Sam used a more temporary and ‘hidden’ approach to authenticating users, but he didn’t think about whether or not those users…

6 views12:17

About

Blog

Apps

Platform